JPMORGAN CHASE & CO

Operational risk is the risk of an adverse outcome resulting from inadequate or failed internal processes or systems; human factors; or external events impacting the Firm’s processes or systems. Operational risk includes compliance, conduct, legal, and estimations and model risk. Operational risk is inherent in the Firm’s activities and can manifest itself in various ways, including fraudulent acts, business disruptions (including those caused by extraordinary events beyond the Firm's control), cyber attacks, inappropriate employee behavior, failure to comply with applicable laws, rules and regulations or failure of vendors or other third party providers to perform in accordance with their agreements. Operational Risk Management attempts to manage operational risk at appropriate levels in light of the Firm’s financial position, the characteristics of its businesses, and the markets and regulatory environments in which it operates.

Operational Risk Management Framework

The Firm’s Compliance, Conduct, and Operational Risk (“CCOR”) Management Framework is designed to enable the Firm to govern, identify, measure, monitor and test, manage and report on the Firm’s operational risk.

Operational Risk Governance

The LOBs and Corporate are responsible for the management of operational risk. The Control Management Organization, which consists of control managers within each LOB and Corporate, is responsible for the day-to-day execution of the CCOR Management Framework.

The Firm’s Global Chief Compliance Officer (“CCO”) and FRE for Operational Risk and Qualitative Risk Appetite is responsible for defining the CCOR Management Framework and establishing the minimum standards for its execution. The LOB and Corporate aligned officers of the CCOR organization oversee activity performed by their aligned LOB and Corporate. These officers report to the Global CCO and FRE for Operational Risk and Qualitative Risk Appetite and are independent of the respective businesses or functions that they oversee. The CCOR Management Framework is included in the Risk Governance and Oversight Policy that is reviewed and approved by the Board Risk Committee periodically.

Operational Risk Identification

The Firm utilizes a structured risk and control self-assessment process that is executed by the LOBs and Corporate. As part of this process, the LOBs and Corporate evaluate the effectiveness of their respective control environment to assess circumstances in which controls have failed, and to determine where remediation efforts may be required. The Firm’s Operational Risk and Compliance organization

(“Operational Risk and Compliance”) provides oversight of and challenge to these evaluations and may also perform independent assessments of significant operational risk events and areas of concentrated or emerging risk.

Operational Risk Measurement

The CCOR organization is responsible for providing independent, risk-based review and oversight of assessments conducted by the LOBs and Corporate with respect to compliance, conduct and operational risks. This includes oversight of the LOBs’ and Corporate’s assessments of the design, execution, and evaluation of associated controls, against standards established by the CCOR organization.

In addition, Operational Risk and Compliance assesses operational risks through quantitative means, including operational risk-based capital and estimation of operational risk losses under both baseline and stressed conditions.

The primary component of the operational risk-based capital estimate is the Loss Distribution Approach (“LDA”) statistical model, which simulates the projected frequency and severity of operational risk losses based on historical data. The LDA model is used to estimate an aggregate operational risk loss over a one-year time horizon, at a 99.9% confidence level. The LDA model incorporates actual internal operational risk losses in the quarter following the period in which those losses were realized, and the calculation generally continues to reflect such losses even after the issues or business activities giving rise to the losses have been remediated or reduced.

As required under the Basel III capital framework, the Firm’s operational risk capital methodology, which uses the Advanced Measurement Approach (“AMA”), incorporates internal and external losses as well as management’s view of tail risk captured through operational risk scenario analysis, and evaluation of key business environment and internal control metrics. The Firm does not reflect the impact of insurance in its AMA estimate of operational risk capital.

The Firm considers the impact of stressed economic conditions on operational risk losses and develops a forward looking view of material operational risk events that may occur in a stressed environment. The Firm’s operational risk stress testing framework is utilized in calculating results for the Firm’s CCAR and other stress testing processes.

Refer to Capital Risk Management on pages 89–99 for information related to operational risk RWA, and CCAR.

Operational Risk Monitoring and Testing

Independent testing and monitoring of controls are integral components of the CCOR Management Framework. These testing and monitoring activities are conducted under the CCOR organization’s Monitoring and Testing Program (“M&T Program”) and:

•are based upon the Firm’s compliance, conduct and operational risk assessments;

•are designed to identify control gaps or deficiencies, including potential non-compliance with applicable laws, rules and regulations; and

•assess whether the procedures, processes and controls used by the Firm to mitigate compliance, conduct and operational risk are well-designed and functioning as intended.

The Testing Center of Excellence (“TCoE”), reporting to the Control Management Organization, is responsible for executing testing activities outlined under the M&T Program, and the CCOR organization Testing Program Governance and Oversight team provides independent governance and oversight of both the M&T Program and the TCoE testing activities through defined processes and responsibilities.

The results of risk assessments performed by Operational Risk and Compliance are used in connection with their independent monitoring and testing compliance of the LOBs and Corporate with laws, rules and regulations. Through monitoring and testing, Operational Risk and Compliance independently identify areas of heightened operational risk and tests the effectiveness of controls within the LOBs and Corporate.

Management of Operational Risk

The operational risk areas or issues identified through monitoring and testing are escalated to the LOBs and Corporate to be remediated through action plans, as needed, to mitigate operational risk. Operational Risk and Compliance may advise the LOBs and Corporate in the development and implementation of action plans.

Operational Risk Reporting

All employees of the Firm are expected to escalate risks appropriately. Risks identified by Operational Risk and Compliance are escalated to the appropriate LOB and Corporate Control Committees, as needed. Operational Risk and Compliance has established standards designed to ensure that consistent operational risk reporting and operational risk reports are produced on a Firmwide basis as well as by the LOBs and Corporate. Reporting includes the evaluation of key risk and performance indicators against established thresholds as well as the assessment of different types of operational risk against stated risk appetite. The standards establish escalation protocols to senior management and to the Board of Directors.

Insurance

One of the ways in which operational risk may be mitigated is through insurance maintained by the Firm. The Firm purchases insurance from commercial insurers and maintains a wholly-owned captive insurer, Park Assurance Company. Insurance may also be

required by third parties with whom the Firm does business.

Subcategories and examples of operational risks

Operational risk can manifest itself in various ways. Operational risk subcategories include Compliance risk, Conduct risk, Legal risk, and Estimations and Model risk. Refer to pages 150, 151, 152 and 153, respectively for more information on Compliance, Conduct, Legal, and Estimations and Model risk. Details on other select examples of operational risks such as firmwide resiliency, payment fraud and third-party outsourcing, as well as cybersecurity, are provided below.

Firmwide resiliency risk

Disruptions of the Firm’s business and operations can occur due to forces beyond the Firm’s control such as health emergencies, severe weather, natural disasters, the effects of climate change, utility or telecommunications failures, interruption of service from third-party service providers, cyberattacks, civil unrest or terrorism. The Firm’s resiliency framework is intended to enable the Firm to prepare for and adapt to changing conditions and withstand and recover from, and address adverse effects on its operations caused by, disruptions that may impact critical business functions and supporting assets, including its staff, technology, data and facilities, as well as those of third-party service providers. The framework includes governance, awareness training, planning and testing of recovery strategies, as well as strategic and tactical initiatives to identify, assess, and manage resiliency risks. The framework operates in accordance with the Firm’s overall approach to Operational Risk Management, including alignment with technology, cybersecurity, data, physical security, crisis management, real estate and outsourcing programs.

Payment fraud risk

Payment fraud risk is the risk of external and internal parties unlawfully obtaining personal monetary benefit through misdirected or otherwise improper payment. The Firm employs various controls for managing payment fraud risk as well as providing employee and client education and awareness trainings.

Third-party outsourcing risk

The Firm‘s Third-Party Oversight (“TPO”) and Inter-affiliates Oversight (“IAO”) frameworks assist the LOBs and Corporate in selecting, documenting, onboarding, monitoring and managing their supplier relationships including services provided by affiliates. The objectives of the TPO framework are to hold suppliers and other third parties to an appropriate standard of operational performance and to mitigate key risks, including data loss and business disruptions. The Corporate Third-Party Oversight group is responsible for Firmwide training, monitoring, reporting and standards with respect to third-party outsourcing risks.

Cybersecurity risk

Cybersecurity risk is the risk of harm or loss resulting from misuse or abuse of technology or the unauthorized disclosure of data.

Cybersecurity risk is an important and continuously evolving focus for the Firm. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Firm’s security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

The Firm has experienced, and expects that it will continue to experience, a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions and emerging technologies that can be leveraged by attackers, including artificial intelligence. The Firm has implemented measures and controls reasonably designed to address this evolving environment, including enhanced threat monitoring. In addition, the Firm continues to review and enhance its capabilities to address associated risks, such as those relating to the management of administrative access to systems.

Third parties with which the Firm does business, that facilitate the Firm’s business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) or that the Firm has acquired are also sources of cybersecurity risk to the Firm. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber attacks, including ransomware and supply-chain compromises, could have a material adverse effect on the Firm, including in circumstances in which an affected third party is unable to deliver a product or service to the Firm or where the incident delivers compromised software to the Firm or results in lost or compromised information of the Firm or its clients or customers.

Clients and customers are also sources of cybersecurity risk to the Firm and its information assets, particularly when their activities and systems are beyond the Firm’s own security and control systems. The Firm engages in periodic discussions with its clients, customers and other external parties concerning cybersecurity risks including opportunities to improve cybersecurity.

Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Firm or its business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that the Firm takes to address cybersecurity risk, the Firm may not be

successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Firm or its business strategy, results of operations or financial condition.

The Global Chief Information Security Officer (“CISO”) reports to the Global Chief Information Officer, and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO and the members of senior management within Global Technology and the Cybersecurity and Technology Controls organizations all have relevant expertise and experience in cybersecurity and information technology risk management, including relevant experience at the Firm, at other financial services companies or in other highly-regulated industries.

The CISO is responsible for the Firm’s Information Security Program, which is designed to prevent, detect and respond to cyber attacks in order to help safeguard the confidentiality, integrity and availability of the Firm's infrastructure, resources and information. The program includes managing the Firm’s global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing the Firm’s policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, the Firm’s cybersecurity capabilities.

The Firm’s Information Security Program includes the following functions:

Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend the Firm against cyber attacks, and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among the Firm’s third-party suppliers.

Technology Governance, Risk & Controls, which is responsible for operationalizing technology risk and control frameworks, analyzing regulatory developments that may impact the Firm, and developing control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk.

Security Awareness, which provides awareness and training that reinforces information risk and security management practices and compliance with the Firm's policies, standards and practices. The training is mandatory for all employees globally on a periodic basis, and it is supplemented by Firmwide testing initiatives, including periodic phishing tests. The Firm also provides specialized security training to employees in specific roles, such as application developers. The Firm’s Global Privacy Program requires all employees to take periodic training on data privacy that focuses on confidentiality and security, as well as responding to unauthorized access to or use of information.

Technology Resiliency, which establishes control requirements for planning and testing the prioritized recovery of technology services in the event of degradation or outage, including incident response planning, data backup and retention, and recovery readiness in support of the Firmwide Business Resiliency Program and operational risk management practices.

The Firm has a cybersecurity incident response plan designed to enable the Firm to respond to attempted cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Firm actively partners with appropriate government and law enforcement agencies and peer industry forums, participating in discussions and simulations to assist in understanding the full spectrum of cybersecurity risks and in enhancing defenses and improving resiliency in the Firm’s operating environment.

The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate cybersecurity risks. Cybersecurity risk management and its governance and oversight are integrated into the Firm’s operational risk management framework, including through the escalation of key risk and control issues to management and the development of risk mitigation plans for heightened risk and control issues. IRM independently assesses and challenges the activities and risk management practices of the Global Cybersecurity and Technology Controls organization related to the identification, assessment, measurement and mitigation of cybersecurity risk. As needed, the Firm engages third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of the Firm’s cybersecurity risk management framework, processes and controls.

The governance and oversight for cybersecurity risk management includes governance forums that inform management of key areas of concern regarding the prevention, detection, mitigation and remediation of cybersecurity risks.

The Cybersecurity and Technology Controls Operating Committee (“CTOC”) is the principal management committee that oversees the Firm’s assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Firm’s Information Security Program. The membership of the CTOC includes senior representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including IRM and Internal Audit.

The CTOC escalates key operational risk and control issues, as appropriate, to the Global Technology Operating Committee (“GTOC”) or its business control committee or to the appropriate LOB and Corporate Control Committees. The GTOC is responsible for the governance of the Firmwide Global Technology organization, including oversight of Firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization.

As part of its oversight of management’s implementation and maintenance of the Firm’s risk management framework, the Firm’s Board of Directors receives periodic updates from the CIO, the CISO and senior members of the CTOC concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Firm’s Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Firm's efforts to address those incidents. The Audit Committee and the Risk Committee assist the Board in this oversight.

COMPLIANCE RISK MANAGEMENT

Compliance risk, a subcategory of operational risk, is the risk of failing to comply with laws, rules, regulations or codes of conduct and standards of self-regulatory organizations.

Each of the LOBs and Corporate hold primary ownership of and accountability for managing their compliance risk. The Firm’s Operational Risk and Compliance Organization (“Operational Risk and Compliance”), which is independent of the LOBs and Corporate, provides independent review, monitoring and oversight of business operations with a focus on compliance with the laws, rules, and regulations applicable to the delivery of the Firm’s products and services to clients and customers.

These compliance risks relate to a wide variety of laws, rules and regulations across the LOBs and Corporate, and jurisdictions, and include risks related to financial products and services, relationships and interactions with clients and customers, and employee activities. For example, compliance risks include those associated with anti-money laundering compliance, trading activities, market conduct, and complying with the laws, rules, and regulations related to the offering of products and services across jurisdictional borders. Compliance risk is also inherent in the Firm’s fiduciary activities, including the failure to exercise the applicable standard of care to act in the best interest of fiduciary clients and customers or to treat fiduciary clients and customers fairly.

Other functions provide oversight of significant regulatory obligations that are specific to their respective areas of responsibility.

Operational Risk and Compliance implements policies and standards designed to govern, identify, measure, monitor and test, manage, and report on compliance risk.

Operational Risk and Compliance is led by the Firm’s Global CCO and FRE for Operational Risk and Qualitative Risk Appetite.

The Firm maintains oversight and coordination of its compliance risk through the CCOR Management Framework. The Firm’s Global CCO and FRE for Operational Risk and Qualitative Risk Appetite also provides regular updates to the Board Risk Committee and the Audit Committee on significant compliance risk issues, as appropriate.

Code of Conduct

The Firm has a Code of Conduct (the “Code”) that sets forth the Firm’s expectation that employees will conduct themselves with integrity, at all times. The Code provides the principles that help govern employee conduct with clients, customers, suppliers, vendors, shareholders, regulators, other employees, as well as with the markets and communities in which the Firm operates. The Code requires employees to promptly report any potential or actual violation of the Code, Firm policies, or laws, rules or regulations applicable to the Firm’s business. It also requires employees to report any illegal or unethical conduct, or conduct that violates the underlying principles of the Code, by any of the Firm’s employees, consultants, clients, customers, suppliers, contract or temporary workers, or business partners or agents. Conduct training is assigned to newly-hired employees after joining the Firm, and to current employees periodically thereafter. Employees are required to affirm their compliance with the Code annually.

Employees can report any potential or actual violations of the Code through the Firm’s Conduct Hotline (the “Hotline”) by phone, mobile device or the internet. The Hotline is anonymous, where permitted by law, is available at all times globally, has translation services, and is administered by an outside service provider. The Code prohibits retaliation against anyone who raises an issue or concern in good faith or assists with an inquiry or investigation. Periodically, the Audit Committee receives reports on the Code of Conduct program.

CONDUCT RISK MANAGEMENT

Conduct risk, a subcategory of operational risk, is the risk that any action or misconduct by an employee could lead to unfair client or customer outcomes, impact the integrity of the markets in which the Firm operates, harm employees or the Firm, or compromise the Firm’s reputation.

Each LOB and Corporate is accountable for identifying and managing its conduct risk to provide appropriate engagement, ownership and sustainability of a culture consistent with the Firm’s Business Principles. The Business Principles serve as a guide for how employees are expected to conduct themselves. With the Business Principles serving as a guide, the Firm’s Code sets out the Firm’s expectations for each employee and provides information and resources to help employees conduct business ethically and in compliance with applicable laws, rules and regulations everywhere the Firm operates. Refer to Compliance Risk Management on page 150 for further discussion of the Code.

The Firm’s oversight and coordination of conduct risk is managed in the same manner as Compliance risk. Refer to Compliance Risk Management onpage 150 for further information.

Conduct risk management encompasses various aspects of people management practices throughout the employee life cycle, including recruiting, onboarding, training and development, performance management, promotion and compensation processes. Each LOB, Treasury and CIO, and each designated corporate function completes an assessment of conduct risk periodically, reviews metrics and issues which may involve conduct risk, and provides conduct education as appropriate.

LEGAL RISK MANAGEMENT

Legal risk, a subcategory of operational risk, is the risk of loss primarily caused by the actual or alleged failure to meet legal obligations that arise from the rule of law in jurisdictions in which the Firm operates, agreements with clients and customers, and products and services offered by the Firm.

The global Legal function (“Legal”) provides legal services and advice to the Firm. Legal is responsible for managing the Firm’s exposure to legal risk by:

•managing actual and potential litigation and enforcement matters, including internal reviews and investigations related to such matters

•advising on products and services, including contract negotiation and documentation

•advising on offering and marketing documents and new business initiatives

•managing dispute resolution

•interpreting existing laws, rules and regulations, and advising on changes to them

•advising on advocacy in connection with contemplated and proposed laws, rules and regulations, and

•providing legal advice to the LOBs, Corporate and the Board.

Legal selects, engages and manages outside counsel for the Firm on all matters in which outside counsel is engaged. In addition, Legal advises the Firm’s Conflicts Office which reviews the Firm’s wholesale transactions that may have the potential to create conflicts of interest for the Firm.

The Firm’s General Counsel reports to the CEO and is a member of the Operating Committee, the Firmwide Risk Committee and the Firmwide Control Committee. The Firm’s General Counsel and other members of Legal report on significant legal matters to the Firm’s Board of Directors and to the Audit Committee.

Legal serves on and advises various committees and advises the Firm’s LOBs and Corporate on potential reputation risk issues.

ESTIMATIONS AND MODEL RISK MANAGEMENT

Estimations and Model risk, a subcategory of operational risk, is the potential for adverse consequences from decisions based on incorrect or misused estimation outputs.

The Firm uses models and other analytical and judgment-based estimations, including those based upon machine learning or artificial intelligence techniques, across various businesses and functions. The estimation methods are of varying levels of sophistication and are used for many purposes, such as the valuation of positions and measurement of risk, assessing regulatory capital requirements, conducting stress testing, evaluating the allowance for credit losses and making business decisions. A dedicated independent function, Model Risk Governance and Review (“MRGR”), defines and governs the Firm’s policies relating to the management of model risk and risks associated with certain analytical and judgment-based estimations, such as those used in risk management, budget forecasting and capital planning and analysis.

Model risks are owned by the users of the models within the LOBs and Corporate based on the specific purposes of such models. Users and developers of models are responsible for developing, implementing and testing their models, as well as referring models to MRGR for review and approval. Once models have been approved, model users and developers are responsible for maintaining a robust operating environment, and must monitor and evaluate the performance of the models on an ongoing basis. Model users and developers may seek to enhance models in response to changes in the relevant portfolios and in product and market developments, as well as to capture improvements in available modeling techniques and systems capabilities.

Models are tiered based on an internal standard according to their complexity, the exposure associated with the model and the Firm’s reliance on the model. This tiering is subject to the approval of MRGR. In its review of a model, MRGR considers whether the model is suitable for the specific purposes for which it will be used. When reviewing a model, MRGR analyzes and challenges the model methodology and the reasonableness of model assumptions, and may perform or require additional testing, including back-testing of model outcomes. Model reviews are approved by the appropriate level of management within MRGR based on the relevant model tier.

Under the Firm’s Estimations and Model Risk Management Policy, MRGR reviews and approves new models, as well as material changes to existing models, prior to their use. In certain circumstances, exceptions may be granted to the Firm’s policy to allow a model to be used prior to review or approval. MRGR may also require the user to take appropriate actions to mitigate the model risk if it is to be used in the interim. These actions will depend on the model and may include, for example, limitation of trading activity.

While models are inherently imprecise, the degree of imprecision or uncertainty can be heightened by the market or economic environment. This is particularly true when the current and forecasted environments are significantly different from the historical environments upon which the models were developed. This increased uncertainty may necessitate a greater degree of judgment and analytics to inform any adjustments that the Firm may make to model outputs than would otherwise be the case. In addition, the Firm may experience increased uncertainty in its estimates if assets acquired differ from those used to develop the models.

Refer to Critical Accounting Estimates Used by the Firm on pages 154–157 and Note 2 for a summary of model-based valuations and other valuation techniques.